REMARKS 

Claims 22-42 are pending and stand rejected. In response, Applicant has amended 
claims 28, 35, and 42. 

35 U.S.C. § 112 Rejections 

Claims 28, 35, and 42 stand rejected under 35 U.S.C. § 112, second paragraph, for 
being indefinite due to an allegedly unclear use of antecedent basis. In response, Applicant 
has amended claim 28 to more clearly specify that the plurality of users introduced in claim 28 
includes the user introduced in claim 22, that is, "the user" (claim 28, line 3) is directed to "a 
user" (claim 22, line 3). Claims 35 and 42 have been analogously amended and analogously 
refer to the user in their corresponding independent claims. Accordingly, amended claims 28, 
35, and 42 comply with 35 U.S.C. § 1 12, second paragraph. 

Claims 22-42 stand rejected under 35 U.S.C. § 1 12, first paragraph, for allegedly failing 
to comply with the written description requirement. Specifically, the Examiner is asserting that 
the following subject matter: "receiving a request from a user to access the resource using a 
process," "resources available to the process," and "if the accessed data specifies that the 
resource is available to the process," was not adequately described in the originally filed 
specification. Applicant respectfully submits the above-cited subject matter was fully described 
numerous times in the specification as filed, including: (1) "The user is then provided with a 
platform on which to run programs [e.g., processes] wherein the user can access the 
program and have the program access various peripherals [e.g., one type of resource] 
through its interaction with the operating system." (Emphasis added), Page 10, paragraph 
[0015]. (2) "Suppose, alternatively, the user is running EXCEL and wishes to use a spell check 
resource. Unless that spell check resource, which resides in the WP program, is included in the 
allowed access rights of the RAT entries [e.g., the accessed data] for the EXCEL program any 
user attempt [e.g., user request] to access it [i.e., the spell check resource] from EXCEL [i.e., 
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an example process] will be denied." (Emphasis added), Page 30, paragraph [0050]. (3) "...if 
the process running on the system has access to that resource, as noted in the resource 
access table 64 [e.g., the accessed data], the operating system 60 will then grant the resource 
for use by the process within the operating system." Page 1 1 , paragraph [0018]. Accordingly, 
independent claims 22, 29, and 36 comply with 35 U.S.C. § 1 12, first paragraph. 

A description as filed is presumed to be adequate, unless or until sufficient evidence or 
reasoning to the contrary has been presented by the examiner to rebut the presumption. See, 
e.g., In re Marzocchi, 439 F.2d 220, 224, 169 USPQ 367, 370 (CCPA 1971). MPEP § 2163.04. 
In rejecting a claim under 35 U.S.C. § 1 12, first paragraph, the Examiner must set forth express 
findings of fact which support the lack of a written description conclusion. MPEP § 2163.04 I. 
Given that Applicant has specifically pointed out where the relevant limitations are supported, if 
the Examiner still maintains that the above limitations do not comply with the written description 
requirement, Applicant respectfully submits the Examiner is required to establish a prima facie 
case to substantiate such an assertion, specifically by providing reasons why a person skilled in 
the art at the time the application was filed would not have recognized that the inventor was in 
possession of the invention as claimed in view of the disclosure of the application as filed. Id. 

35 U.S.C. S 102(a) Rejections 
Claims 22, 23, 28-30, 35-37, and 42 stand rejected under 35 U.S.C. § 102(a) as being 
anticipated by Park et al. (February 2001) (Park hereafter). Independent claims 22, 29, and 36 
recite, in substance: 

accessing data associated with the user stored in a memory in response to the 

received request, the data specifying one or more resources available to the 
process; and 

providing the process with access to the resource if the accessed data specifies 
that the resource is available to the process. 

(emphasis added, quoting from claim 22). 
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Applicant teaches process-based access control, wherein a process is provided with 
access to a resource if the accessed data specifies that the resource is available to the 
process. Applicant respectfully submits that Park does not disclose providing the process with 
access to the resource if the accessed data specifies that the resource is available to the 
process, the data both specifying one or more resources available to the process and being 
accessed in response to the received request. 

In contrast, Park teaches role-based access control wherein access is provided to a 
resource if the data specifies that the resource is available to the role of the user . "7. Display 
appropriate resources after authorization check based on client's roles" Park, page 65, Fig. 18 
(emphasis added). Park's "Role-Based Access Control on the Web" article is wholly concerned 
with role-based access control, the basis of which is explained as follows: "Its [role-based 
access control's] basic notion is that permissions are associated with roles, and users are 
assigned to appropriate roles." Park, page 39, Section 2. Park handles access control through 
roles of users, so access is provided to a resource if the data specifies that the resource is 
available to the role of the user; not if the accessed data specifies that the resource is available 
to the process. 

Accordingly, given Park fails to teach at least one limitation of claims 22, 29, and 36, 
these claims are patentable over Park. Claims 23, 28, 30, 35, 37, and 42 depend from claim 
22, 29, or 36, either directly or via intervening claims. Therefore, for at least the same reasons 
above, claims 23, 28, 30, 35, 37, and 42 are also patentable over Park. 

Further, while Applicant respectfully submits that dependent claims 23, 28, 30, 35, 37, 
and 42 are patentable over Park based on their respective independent claims, these 
dependent claims are also patentable over Park based on their respective additional novel 
recitations. For example, claim 23 specifically recites "wherein the data stored in the memory 
comprises a process resource access table for the process and associated with the user, the 
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process resource access table specifying an access right of the process to the resource." The 
Examiner rejected claim 23 based on Park, page 64, lines 1-8, which discusses a table that "is 
referenced to check if the user has proper roles to access particular resources...." Park, page 
64, lines 6-7. Applicant respectfully submits that such a table in no way anticipates a process 
resource access table which specifies an access right of a process to a resource. Park does 
not anticipate this additional limitation of claim 23 for not the least of which reason Park teaches 
a role-based access control system, and not Applicants process-based security system. 

35 U.S.C. S 102(b) Rejections 
Claims 22, 23, 28-30, 35-37, and 42 stand rejected under 35 U.S.C. § 102(b) as being 
anticipated by Park. As fully discussed above, Park does not anticipate claims 22, 23, 28-30, 
35-37, and 42 because Park fails to teach at least one limitation of independent claims 22, 29, 
and 36. Additionally, the Examiner asserts that the parent application (10/061,701) does not 
provide a written basis for the new claims. Applicant respectfully submits the parent application 
does provide such a basis because the same supporting disclosure cited in the application at 
issue is also disclosed in the parent application. Accordingly, Park is unavailable as 35 U.S.C. 
§ 102(b) prior art. 

35 U.S.C. S 102(e) Rejections 

Claims 22-24, 27, 29-31, 34, 36-38, and 41 stand rejected under 35 U.S.C. § 102(e) as 

being anticipated by Trabelsi et al. (US 2001/0056494) (Trabelsi hereafter). Independent 

claims 22, 29, and 36 recite, in substance: 

accessing data associated with the user stored in a memory in response to the 

received request, the data specifying one or more resources available to the 
process; and 

providing the process with access to the resource if the accessed data specifies 
that the resource is available to the process. 

(emphasis added, quoting from claim 22). 
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Applicant respectfully submits that Trabelsi does not disclose providing the process with 
access to the resource if the accessed data specifies that the resource is available to the 
process, the data both specifying one or more resources available to the process and being 
accessed in response to the received request. In contrast, Trabelsi teaches role-based access 
control wherein access is provided to a resource if the data specifies that the resource is 
available to the role of the user . "A validity domain defines a part of a set of resources 2d that 
is accessible for a given role." Trabelsi, page 3, paragraph [0046]. Trabelsi handles access 
control through roles of users, so access is provided to a resource if the data specifies that the 
resource is available to the role of the user; not if the accessed data specifies that the resource 
is available to the process. 

Accordingly, given Trabelsi fails to teach at least one limitation of claims 22, 29, and 36, 
these claims are patentable over Trabelsi. Claims 23-24, 27, 30-31 , 34, 37-38, and 41 depend 
from claim 22, 29, or 36, either directly or via intervening claims. Therefore, for at least the 
same reasons above, claims 23-24, 27, 30-31 , 34, 37-38, and 41 are also patentable over 
Trabelsi. 

Additionally, the Examiner addressed claims 25-26, 32-33, and 39-40 only with regard to 
35 U.S.C. § 1 12, first paragraph. Applicant thus understands that if the Examiner were to 
withdraw the new matter rejection, claims 25-26, 32-33, and 39-40 would be deemed allowable 
subject matter by virtue of the new matter rejection withdrawal alone. 
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For the above reasons, Applicant respectfully submits that the claimed invention is 



allowable over the art of record, and requests that the claims be allowed. The Examiner is 



invited to contact the undersigned by telephone in order to advance the prosecution of this 



application. 



Respectfully submitted, 
VINCENT ALAN LARSEN 



Pierre Keeley, RegrTJa^7,045 
Attorney for Applicant 
Fenwick & West LLP 
801 California Street 
Mountain View, CA 94041 
Tel.: (650)335-7242 
Fax: (650)938-5200 



Dated: May 9, 2006 
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